spam management (external mx & junk folder)

[Artturi]

Hello,

Sorry if this has already been covered, looking for spam gives so many result that I'm not sure this has not been discussed.

We have a dedicated antispam server (MailScanner). I'd like this server to deliver spams whose score is over 6 and zimbra to store them in users "junk" folder automatically.
What should I do to achieve this ?
Moreover, is it possible to desactivate spam analysis for these messages ?

Finally, is there a way to automatically remove old messages from this junk folder (useful if user forgets to clean this folder to avoid over quota situation).

Thanks,

Artturi

[abhullar]

The below headers configuration is what ZCS looks for to send spam messages in junk folder:

zmprov gacf | grep Header
zimbraSpamHeader: X-Spam-Flag
zimbraSpamHeaderValue: YES

You can modify the header and value, to what you 3rd party spam engine tags your messages with. To modify:

zmprov mcf zimbraSpamHeader X-MySpamEngineTag
zmprov mcf zimbraSpamHeaderValue SPAM

To disable Spam Engine on ZCS

you're going to need to modify the /opt/zimbra/conf/zmmta.cf file, and remove anything that looks like

if SERVICE antivirus
POSTCONF content_filter smtp-amavis:[127.0.0.1]:10024
fi
if SERVICE !antispam
POSTCONF content_filter smtp-amavis:[127.0.0.1]:10024
fi

Then, do a
postconf -e content_filter=

and restart postfix; this will completely bypass the system.

If you don't want to bypass AV, then edit amavisd.conf.in:
Change the line
%%comment SERVICE:antispam%% @bypass_spam_checks_maps = (1);
to
@bypass_spam_checks_maps = (1);

Then restart all services on the box.

#content_filter = smtp-amavis:[127.0.0.1]:10024t

[daneturner]

What would be the result if the MailScanner server were configured to add the same header that Zimbra is looking for by default (X-Spam-Flag: YES)?

Would the message still get passed to Amavisd? To SpamAssassin? I guess the key question is, at what point in mail delivery does Zimbra look for the X-Spam-Flag header?

[daneturner]

It looks like some piece of Zimbra's mail delivery chain (postfix, amavis, spamassassin) removes the X-Spam-Flag header that my Brightmail anti-spam appliance adds. This, I think, is the header that Spamassassin uses to identify spam too.

I'd like to combine the spam-fighting abilities of my Brightmail appliance, and Zimbra's Spamassassin. But if SA removes the header that Brightmail adds, this doesn't seem to be possible.

Any suggestions?

[Artturi]

Originally Posted by abhullar

The below headers configuration is what ZCS looks for to send spam messages in junk folder:

zmprov gacf | grep Header
zimbraSpamHeader: X-Spam-Flag
zimbraSpamHeaderValue: YES

You can modify the header and value, to what you 3rd party spam engine tags your messages with. To modify:

zmprov mcf zimbraSpamHeader X-MySpamEngineTag
zmprov mcf zimbraSpamHeaderValue SPAM

I finally applied this modification to my system but I left spam detection active :

zmprov gacf | grep Header
zimbraSpamHeader: X-paris.iufm.fr-MailScanner-SpamCheck
zimbraSpamHeaderValue: polluriel

The last line is perhaps wrong because "polluriel" is only the beginning of the value. After this, Mailscanner adds the score.

Now that's in place, spams do not arrive in "Junk" folder but in Inbox.

Do you have an idea of what to do to correct that ?

Thanks in advance,

Artturi

[Protack]

Originally Posted by abhullar

The below headers configuration is what ZCS looks for to send spam messages in junk folder:

zmprov gacf | grep Header
zimbraSpamHeader: X-Spam-Flag
zimbraSpamHeaderValue: YES

You can modify the header and value, to what you 3rd party spam engine tags your messages with. To modify:

zmprov mcf zimbraSpamHeader X-MySpamEngineTag
zmprov mcf zimbraSpamHeaderValue SPAM

To disable Spam Engine on ZCS

you're going to need to modify the /opt/zimbra/conf/zmmta.cf file, and remove anything that looks like

if SERVICE antivirus
POSTCONF content_filter smtp-amavis:[127.0.0.1]:10024
fi
if SERVICE !antispam
POSTCONF content_filter smtp-amavis:[127.0.0.1]:10024
fi

Then, do a
postconf -e content_filter=

and restart postfix; this will completely bypass the system.

If you don't want to bypass AV, then edit amavisd.conf.in:
Change the line
%%comment SERVICE:antispam%% @bypass_spam_checks_maps = (1);
to
@bypass_spam_checks_maps = (1);

Then restart all services on the box.

#content_filter = smtp-amavis:[127.0.0.1]:10024t

Since we know what Zimbra looks for to consider spam and place in the Junk folder, what does it look for to be considered on a whitelist? Or is this just handled through Amavis/Spamassassin?

God Bless,
Marty